Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

deSEC – Free Secure DNS

desec.io

Post reply on HN
Print view View original

41–50 of 59 posts

Re: deSEC – Free Secure DNS

#41

Post by traceroute66 »

Stitch4223 wrote: post #36
traceroute66 wrote: post #9

Earlier quoted context omitted.

> We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. I mean, if your definition of "affordable" is free, then sure. But for the record there are other affordable EU suppliers who do DNSSEC: - Bunny DNS[0] is "free" – i.e. only subject to their minimum $1/month account spend fee. - RcodeZero is very affordable[1] plus added bonus it is run by the `.at` re…

We have a support ticket at Bunny that has been open for months precisely because they don’t provide state-of-the-art DNSSEC. We had to move to another provider, as we have a deadline to comply with at the end of this month. I don’t know what the issue is off the top of my head. Netnod.se uses a DNSKEY that is too small on their main domain. Rcodezero.at might indeed be something. Thanks. We donate to deSEC, so it’s…

> Netnod.se uses a DNSKEY that is too small on their main domain.

Interesting, could you expand on that ?

I ran netnod.se through the Verisign[1] and internet.nl[2] and it passes DNSSEC tests ?

[1] https://dnssec-analyzer.verisignlabs.com/netnod.se [2] https://internet.nl/site/netnod.se

Re: deSEC – Free Secure DNS

#42

Post by WhyNotHugo »

zetanor wrote: post #19

When I last tried deSEC, the service was reliable and well worth the price of admission, but the web UI and API were both quite rough, and propagation tended to be quite slow. It was annoying to do an ACME DNS01 challenge on it, for example. IIRC, the API didn't have a complete set of replace/edit endpoints, so even DNSControl ( https://github.com/DNSControl/dnscontrol ) would leave records nonexistent for a while wh…

I wrote a little cli to import a zone file into deSEC: https://git.sr.ht/~whynothugo/zone2desec

I can also show a delta when you've made changes and asks for confirmation before applying.

Re: deSEC – Free Secure DNS

#43

Post by Stitch4223 »

traceroute66 wrote: post #41
Stitch4223 wrote: post #36

Earlier quoted context omitted.

We have a support ticket at Bunny that has been open for months precisely because they don’t provide state-of-the-art DNSSEC. We had to move to another provider, as we have a deadline to comply with at the end of this month. I don’t know what the issue is off the top of my head. Netnod.se uses a DNSKEY that is too small on their main domain. Rcodezero.at might indeed be something. Thanks. We donate to deSEC, so it’s…

> Netnod.se uses a DNSKEY that is too small on their main domain. Interesting, could you expand on that ? I ran netnod.se through the Verisign[1] and internet.nl[2] and it passes DNSSEC tests ? [1] https://dnssec-analyzer.verisignlabs.com/netnod.se [2] https://internet.nl/site/netnod.se

Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3]

Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength.

Verisign does check for key validity but not for key strength / length as seen in your link.

[1] https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.nl/4280424/#control-panel-... [5] https://github.com/internetstandards/Internet.nl/issues/1176

Re: deSEC – Free Secure DNS

#44

Post by digitalPhonix »

apefulsin wrote: post #20
dsl wrote: post #14

Earlier quoted context omitted.

DNSSEC support is an anti-feature, it is dead/dying and the faster we can unburden ourselves from it the faster we can move on to better solutions. https://sockpuppet.org/blog/2015/01/15/against-dnssec/

So DNS should be open to MITM attackers?

Did you read the article? It's saying that DNSSEC as an implementation to prevent MITM is flawed; other solutions that protect against MITM are proposed.

Re: deSEC – Free Secure DNS

#45

Post by quicksilver03 »

andreaso wrote: post #31
quicksilver03 wrote: post #22

Earlier quoted context omitted.

I happen to run an affordable EU supplier who does DNSSEC, and also AXFR (incoming and outgoing). I offer a free plan from time to time, but not at the moment to preserve resources for paying customer. https://www.ptrdns.net/

Are you aware that the child zone A(AAAA) records for danube.ns.ptrdns.net differs from the parent zone A(AAA) glue records for danube.ns.ptrdns.net? Looks like it's the glue records that point to the actual server?

Thanks for letting me know!

This is fixed now, I'll look into why the monitoring tools didn't catch this one as they should have.

Re: deSEC – Free Secure DNS

#46

Post by [deleted] »

dmm wrote: post #39

I switched to deSEC because they allow you to create tokens for DNS-01 validation which are tightly scoped to a single subdomain. This means I have a VM running "service1.foo.example.com" which is not publicly available but can still get certs from letsencrypt, but with a token that can't be used to issue certs for other domains. It works great!

[deleted]

Re: deSEC – Free Secure DNS

#47

Post by hexfish »

aequitas wrote: post #7

Recently migrated to deSEC, great experience so far, except for hitting the API rate limit when using Tofu to plan and apply changes with around a 100 domains. For now I'm using `-parallelism=1` which seems to work.

How did you get access to 100 domains on there?

Re: deSEC – Free Secure DNS

#48

Post by thayne »

dsl wrote: post #34
teddyh wrote: post #30

Earlier quoted context omitted.

Rebuttal: https://easydns.com/blog/2015/08/06/for-dnssec/ >

That rebuttal held water 10 years ago, but fortunately we have made a lot of advancements since then. DNSSEC was a solution trying to solve the problem of DNS security while still maintaining transparency for DNS operators to spy on queries. At the time, passive DNS was one of the tent poles of tracking malware and responding to security incidents. We have since committed entirely to transport security in the form of…

DoH only secures the connection between the DoH provider and the client, not the response from the authoritative DNS server. It also isn't sufficient for DANE or similar. So DoH doesn't completely solve the problems DNSSEC tried to.

Re: deSEC – Free Secure DNS

#49

Post by traceroute66 »

Stitch4223 wrote: post #43
traceroute66 wrote: post #41

Earlier quoted context omitted.

> Netnod.se uses a DNSKEY that is too small on their main domain. Interesting, could you expand on that ? I ran netnod.se through the Verisign[1] and internet.nl[2] and it passes DNSSEC tests ? [1] https://dnssec-analyzer.verisignlabs.com/netnod.se [2] https://internet.nl/site/netnod.se

Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3] Internet.nl does not look at DNSSEC that extensively, allowing poorer…

Super, thanks. zonemaster added to my bookmarks !

Re: deSEC – Free Secure DNS

#50

Post by wildylion »

thayne wrote: post #48
dsl wrote: post #34

Earlier quoted context omitted.

That rebuttal held water 10 years ago, but fortunately we have made a lot of advancements since then. DNSSEC was a solution trying to solve the problem of DNS security while still maintaining transparency for DNS operators to spy on queries. At the time, passive DNS was one of the tent poles of tracking malware and responding to security incidents. We have since committed entirely to transport security in the form of…

DoH only secures the connection between the DoH provider and the client, not the response from the authoritative DNS server. It also isn't sufficient for DANE or similar. So DoH doesn't completely solve the problems DNSSEC tried to.

Exactly. And now there's https://datatracker.ietf.org/doc/html/rfc9539> that allows encrypted DNS between authoritative and recursive servers as well.
Post reply on HN